What is a Zoned Architecture?
A Zoned Architecture is a network design in which an industrial network is divided into logical zones of systems with similar functions and security requirements, and in which all communication between those zones passes through controlled boundaries with firewalls, filters and access controls. The aim is that an attacker or a piece of malware that reaches one zone cannot move freely to the rest of the plant. A zoned architecture is the practical form of defence in depth in OT networks: every zone boundary is an extra layer that slows an attack down, makes it visible and contains it.
Zoned Architecture is a core principle within IEC 62443 and aligns with the zones and conduits model and the Purdue Model for industrial networks.
🧠 How does it differ from zones and conduits and the Purdue Model?
The three terms are often used interchangeably, but they describe different things. The Purdue Model provides the levels, IEC 62443 provides the method, and the zoned architecture is the design that results from both at a specific site.
| Term | What it is | Origin | Question it answers |
|---|---|---|---|
| Purdue Model | Reference model with levels 0 to 5, from field devices to the business network | Purdue University (1989-1992), basis for ISA-95 | Which functions belong at which level? |
| Zones and Conduits Model | Method for grouping assets into zones with a target security level and routing traffic through conduits | IEC 62443-3-2 (2020) and IEC 62443-3-3 (2013) | How do I define zones, risks and requirements? |
| Zoned Architecture | The concrete network design with zones, zone boundaries, rules and management | Practice, reference architectures from NIST SP 800-82 and vendors | What does my network look like in practice? |
| Network Segmentation | The technical separation itself (subnets, VLANs, firewalls) | General networking practice | Which means do I use to separate traffic? |
A zone is not a synonym for a Purdue level. The PLCs and HMIs of one production line can together form a single zone, while a SIS at the same level gets a zone of its own.
🏭 Why does OT need a zoned architecture?
Factories, water treatment plants and power stations run many different systems side by side: PLC, SCADA, Historian, engineering stations and office applications. In a flat network every device can reach every other device. That is risky, because much OT equipment has no authentication at protocol level and often cannot be patched.
With a zoned architecture you can:
- Limit risks by separating functions - office IT, process control and safety systems only meet through named connections.
- Tailor security per zone - a safety system gets stricter controls than a reporting server.
- Shield vulnerable systems - an old PLC that cannot be patched is protected by the zone boundary instead of by an update.
- Demonstrate Compliance - for NIS2, IEC 62443 and ISO 27001, a zone and data flow diagram is strong evidence.
- Minimise the impact of incidents - an infection stays confined to one zone.
Two well-known incidents show why this matters. In NotPetya (2017), the wiper spread at high speed through flat, globally connected corporate networks. At Colonial Pipeline (2021), ransomware only hit the IT network, but the pipeline was shut down as a precaution, because it was not certain that the OT environment was unaffected and business processes such as billing depended on the IT network.
🏗️ Which zones does a typical zoned architecture have?
Many reference architectures, such as Converged Plantwide Ethernet (CPwE) from Cisco and Rockwell Automation, use a similar layout. The SL-T values below are illustrative; in practice they follow from your own risk assessment.
| Zone | Purdue level | Example systems | Typical SL-T |
|---|---|---|---|
| Enterprise Zone | 4-5 | ERP, email, intranet, office IT | n/a (IT policy) |
| IDMZ | 3.5 | Remote Access, web server, replica historian, patch server, jump server | 2-3 |
| Site Operations Zone | 3 | MES, central historian, OT domain controller | 2 |
| Supervisory Zone | 2 | SCADA, HMI, engineering stations | 2-3 |
| Control Zone (cell/area) | 1 | PLC, RTU, Remote IO | 2-3 |
| Field Zone | 0 | sensors, actuators, IO modules | follows the control zone |
| Safety Zone | 1 | SIS, safety PLCs | 3 |
Communication between zones takes place via tightly controlled Conduits, for example an industrial firewall, protocol filtering or a jump server.
In CPwE, levels 0 to 2 often form a single cell/area zone together. The separate supervisory, control and field zones in the table are a finer split, which you choose only when the risk or the size of the plant justifies it.
A golden rule in the IDMZ: no traffic flows directly from Enterprise to OT. Every session terminates in the IDMZ and is rebuilt there, for example through a replica of the historian or a jump server with MFA.
🔄 How does a zoned network differ from a flat network?
| Characteristic | Flat network | Zoned architecture | Microsegmentation |
|---|---|---|---|
| Separation | None, everything in one broadcast domain | Groups of systems by function and risk | Per device or per application |
| Lateral movement | Unrestricted | Limited to the zone itself | Severely restricted, only through explicitly permitted connections |
| Management effort | Low | Moderate, dozens of rules per zone boundary | High, many fine-grained rules |
| Suitable for | Only small, isolated installations | Almost any OT environment | Critical zones and modern, well-documented systems |
| Relation to Zero Trust | Opposite | First step | Close to the zero trust principle |
In practice a zoned architecture is the foundation, and you add microsegmentation inside zones where it genuinely reduces risk.
🔧 Which techniques separate the zones?
| Technique | Strength | Typical location |
|---|---|---|
| Next-Gen Firewall or industrial firewall | High, with default deny and deep packet inspection of OT protocols | IT/OT boundary, IDMZ, supervisory-control boundary |
| Data diode | Very high, physically one-way traffic | Exporting process data from critical zones |
| VLAN with ACLs on a layer 3 switch | Moderate, a VLAN alone is not a security boundary | Separation within a zone or between cells |
| Protocol filtering | High at application level | For example only read-only Modbus TCP function codes to a PLC |
| Jump server with remote access control | High for administrative access | IDMZ, for suppliers and administrators |
In IEC 62443-3-3 this falls under Foundational Requirement 5, Restricted Data Flow: SR 5.1 (network segmentation), SR 5.2 (zone boundary protection), SR 5.3 (general purpose person-to-person communication restrictions) and SR 5.4 (application partitioning).
🔐 Which security measures belong in each zone?
- Firewalls and next-gen firewalls between zones, governed by structured firewall rule management
- Access Control and User-Based Access Control so that only authorised people can enter a zone
- Anomaly detection in the supervisory and control zones, because OT traffic is predictable and deviations stand out
- Application Control on servers and engineering stations
- Patch management tailored to zone and availability: fast in the IDMZ, scheduled during shutdowns in the control zone
- Monitoring and SIEM with log sources from the supervisory zone and the DMZ
- Encryption for conduits that run over shared or external networks
🛠️ How do you set up a zoned architecture step by step?
In an existing plant (brownfield), zoning is a migration, not a one-off rebuild. A proven sequence:
- Inventory assets and data flows - an up-to-date asset inventory and an overview of who talks to whom, for example with passive asset discovery.
- Assess the risk - following IEC 62443-3-2: define the System under Consideration, partition it into zones and conduits and assign an SL-T per zone. Among other things, the standard requires business IT and OT assets to sit in separate zones (ZCR 3.2).
- Start at the IT/OT boundary - build the IDMZ first, because that is where the greatest risk lies (internet, email, ransomware coming from office IT).
- Separate the safety systems - give the SIS its own zone with only read-only status traffic going out. IEC 62443-3-2 requires this explicitly (ZCR 3.3); if separation is not possible, you treat the whole zone as safety-related.
- Work from coarse to fine - first zones per site and per line, then cells within a line.
- Start firewalls in learning mode - log all traffic first, then write the rules, and only then switch to default deny. This prevents a forgotten connection from stopping production.
- Document everything and manage change - zone and conduit diagrams, rule sets with an owner and a reason, and a fixed change management process.
Rules of thumb from practice: a well-designed zone boundary has dozens of rules, not hundreds; every rule has an owner and a reason; and rule sets are reviewed at least once a year and after every major change.
🇪🇺 What role does zoning play in regulation and standards?
- NIS2 - Article 21 requires risk-based measures, including the security of network and information systems. Implementing Regulation (EU) 2024/2690 explicitly names network segmentation for digital service providers, such as cloud and data centre providers, and is a useful benchmark for other sectors.
- Cybersecurity Act - the Dutch transposition of NIS2 (Cyberbeveiligingswet) entered into force on 15 August 2026; documented zoning helps you demonstrate your duty of care.
- NIST SP 800-82 - Revision 3 (September 2023) describes OT architectures with a DMZ between IT and OT, data diodes and defence in depth.
- ISO 27001 - control A.8.22 (segregation of networks) in the 2022 edition.
- NIST CSF - network segmentation belongs to the Protect function.
⚠️ What are the benefits and pitfalls?
Benefits:
- Segmentation limits attack vectors and lateral movement.
- Measures per zone can be better tailored to risk and availability.
- Scalable - zones can be expanded or managed individually.
- Compliance-friendly for IEC 62443, ISO 27001 and NIST CSF.
Pitfalls:
- Incomplete inventory - without a clear asset and network inventory you will miss connections.
- Disrupted communication - an overly strict rule can stop a process; test in learning mode first.
- Back doors - a supplier’s 4G router or a dual-homed engineering laptop bypasses the zone boundary.
- Erosion - without maintenance and documentation a rule set fills up with “temporary” exceptions.
❓ Frequently asked questions
Is a zoned architecture the same as the Purdue Model?
No, a zoned architecture is the concrete network design, whereas the Purdue Model only describes levels of functions. The Purdue levels are a good starting point for zones, but one zone can span several levels and one level can contain several zones.
Is a VLAN enough to separate zones?
A VLAN on its own is not a security boundary, because it separates traffic but does not filter or inspect it. In a zoned architecture you combine VLANs with ACLs or, at higher-risk zone boundaries, with a firewall that only allows named connections.
How many zones does a plant need?
The number of zones in a zoned architecture follows from the risk assessment, not from a fixed number. A medium-sized plant often ends up with five to ten zones, such as enterprise, IDMZ, site operations, supervisory, one or more control zones and a safety zone.
Where do you start zoning an existing plant?
Start at the boundary between IT and OT by building an IDMZ, because many OT incidents, such as ransomware, come in through office IT. Then separate the safety system and work step by step towards zones per production line.
Does NIS2 require a zoned architecture?
NIS2 does not prescribe a specific zoned architecture, but it does require appropriate, risk-based measures for network security. For OT environments, documented zoning according to IEC 62443 is a common and well-founded way to demonstrate that you meet this requirement.
What is the difference between a DMZ and an IDMZ?
A DMZ is a buffer zone between an internal network and the internet, whereas an IDMZ is the buffer zone between the office network and the OT network. In a zoned architecture all traffic between IT and OT terminates in the IDMZ, so that no direct connection exists between the two worlds.
📌 In summary
A Zoned Architecture divides an OT network into zones with their own security requirements and routes all traffic between those zones through controlled conduits. This keeps an incident confined to one zone, shields vulnerable systems and lets you show auditors and regulators how you manage risk. Start at the IT/OT boundary, separate the safety system and keep rule sets small, documented and up to date.